Posted
by
Zonk
on Saturday December 23, 2006 @06:22AM
from the and-the-losers-are dept.

An anonymous reader writes "HNS is running an article with a list of those malicious codes which, although they may not have caused serious epidemics, stood out in one way or another. Some of the categories are: the biggest snooper, the most moralistic, the worst job applicant and the most tenacious. From the article: 'The most competitive. Once the Popuper spyware has installed itself on a computer, it runs a pirate version of a well-known antivirus application. Far from trying to do the user a favour, it is actually trying to eliminate any possible rival from the computer. It seems that the fight for supremacy has also reached the world of Internet threats.'"

The severity of the virus, the spread of the virus, and the stupidity of the users necessary for the the first two.

The few viruses (they were actually non self-replicating trojans -- most were modified versions of Opener) that affected people on rumour forums required people to give the trojan/script admin (sudo) privileges. I'm sorry, but no matter what OS you're on, giving a virus sudo means game over.

Computer viruses--Windows-based computer viruses, for the most part--have been around for a long time now, but it's really only since the explosion of the Internet (the modern, commercialized Internet, that is) that they've caught the public eye, and it's only within the past 2-3 years (since the first "rock star" viruses, Melissa, A

Well, you see, there are viruses for linux. However, they don't spread a lot (because if someone uses linux, he has enough knowledge not to open an attachment/install an unknown file.)
And well, saying that WIndows is bad because almost all viruses are designed for them is like saying that houses are bad, because thieves might try to break in...

Well, that's only part of the truth. There are three reasons why Linux viruses don't get around like Windows viruses; better security, lower population (also encompasses the lack of monoculture in network applications), and more careful users. And none of those reasons is the "real reason", they work in combination with each other to make the difference really really big.

Bad analogy. This is more like saying that your wooden house is bad, since it's very susceptible to fire.

My stone house, on the other hand, is not very susceptible to fire. That means it's better.

*Notice that I'm convienently ignoring how difficult it is to run anything through the walls, compared to that wooden house, in addition to how cold the stones get during the winter (and the subsequent lack of insulation), etc.*

It sure seems to have come down to a matter of simple denial with the Windows platform. Vista has barely been released yet, and there are exploits[0] out for it. How can anyone claim to be concerned about system integrity[1] *and* be a windows advocate at the same time? It is a blatant contradiction. There are so many different alternatives with a better overall design that it makes no sense to run Windows unless you have been locked-in to the platform. If you are not yet locked-in, it seems Vista will help you with that[2].

However, they don't spread a lot (because if someone uses linux, he has enough knowledge not to open an attachment/install an unknown file.)

Well, one *hopes* they have that! That practice has been a mainstay since the first viruses cropped up. However, believing that you're safe because you're running Linux, without following good practices is pretty dumb too. The first time someone's running as root and downloads an untrustworthy file...

"The first time someone's running as root and downloads an untrustworthy file..."

But that's not really an issue is it? What Linux distribution has the default user as Root these days? In fact, it's more difficult to run as root in some distributions instead of as a normal user, in that the "root account" is never enabled. Attempt to login to (X,K,Ed)Ubuntu as root at the login screen and it won't work.

How to get a Windows computer infected:

Connect to the 'net without a firewall or run IE and visit a bad page. Or, run OE (interesting that Outlook Express has the same initials as "Operator Error") for your mail. Or run p2p software and download a "song" that doesn't play (but is instead an executable file). In fact, I've got a friend whose daughter did exactly the latter, and I'm going to fix it after the weekend. I beginning to think that these days, that's the most common vector of infection, as I see it time and time again.

Windows gives execute permission based on the file name extension. For this utterly stupid idea held over from the frickin' CP/M days, users are being hosed left, right, up, and down. This bogosity should have died with Windows 3.1 or at least after Bill Gates discovered the 'net and put out Win98. However, the concept is still with us in Vista, so techs everwhere are going to be guaranteed a paycheck for at least the next 5 years.

How to infect a Unix or Linux machine:

Automatically through mail? Impossible to do without user interaction, since everything that comes down the pipe doesn't have the execute bits turned on. Anyone who writes an MUA that does that autmatically will be taken out back and hit with the clue bat.

Visit a web page? There's no such thing as a drive-by install. The user has to download the file and manually set the execute bits high again, through chmod or by right-clicking on the file.

Use p2p? Everything downloaded has no execute bit. What data file _ever_ deserves an execute bit? Indeed, I have yet to ever receive a file from the wire that has execute bits turned on except when they're contained within an installation package, and for that to work, I need to pause and use root permission if it's an install for the whole machine and I still have to unpack it even if it's going in my home directory.

In fact, the simple act of user interaction, even if it's the typing of the current user's password (OS/X) prevents a whole lot of evil. It's that short pause that gives the user the chance to _think_, if even for half a second, and say _no_ to random malware. If you're a malware writer and you give your victims the chance to think, your bit of evil goes nowhere. There are only so many times that people are going to install a fucking purple gorilla.

This ignores the population that will run silly "cupholder" executables and trojan filled "free screensavers," at every opportunity whether in Linux, Unix, or Windows, but then real stupidity trumps artificial intelligence every time. You can only do so much if a user is determined to blow each toe off his foot with a.44 one by one.

If this means that Unix and Linux are more difficult, (as if typing the current user's password is complex) so bloody what? It's damn inconvenient when a computer gets infected, isn't it?

Automatically through mail? Impossible to do without user interaction, since everything that comes down the pipe doesn't have the execute bits turned on. Anyone who writes an MUA that does that autmatically will be taken out back and hit with the clue bat.

This ignores the population that will run silly "cupholder" executables and trojan filled "free screensavers," at every opportunity whether in Linux, Unix, or Windows, but then real stupidity trumps artificial intelligence every time.

Which was my point. I cringe every time that someone says "I can't get a virus because I'm running Linux!" Linux makes it more difficult than Windows by several orders of magnitude, but it doesn't mean that it's impossible. In case you're wondering, I have seen people wh

"Running a given operating system does not incur automatic protection in the absence of proper procedure."You and I are on the same side. Heh.

When, at first, I couldn't use the root account in Ubuntu, I enabled it using sudo passwd. But upon reflection, after thinking that not having an active root account was a bit of bogosity (I'm a big boy, I know what I'm doing), I have changed my mind and agreed with the Ubuntu and OS/X method of using sudo for everything. It keeps one from playing "admin" for too l

"The first time someone's running as root and downloads an untrustworthy file..."But that's not really an issue is it? What Linux distribution has the default user as Root these days? In fact, it's more difficult to run as root in some distributions instead of as a normal user, in that the "root account" is never enabled. Attempt to login to (X,K,Ed)Ubuntu as root at the login screen and it won't work.-------------While that may be true, you want to know how much effort its required to enable that? not much

"While that may be true, you want to know how much effort its required to enable that? "I know exactly how much effort. I actually mentioned a way to do it up there, in case you hadn't read. However, the newbie is not TOLD to do it, and so by default, only when the newbie _learns_ what to do, the newbie can enable it or not.

But by then, the newbie has probably operated under sudo long enough that it's second nature and probably has picked up the clue that it's more secure that way anyway.

"I don't see why privilege separation should help. There is no need to run that spambot as root."Because if a spambot is running as an ordinary user, it's ridiculously easy to kill and remove. A userland spambot is next to useless, because it will have a very short life. Where does it get launched? In.profile? How do you hide it? Unless you're root, you can't modify logs, netstat, or ps. And once you've got root privs, it's stupid to run the bot in userland anyway. So you're wrong. Priv separation

And well, saying that WIndows is bad because almost all viruses are designed for them is like saying that houses are bad, because thieves might try to break in...

Windows is like a house where all of the doors are unlocked and most of the residents can't figure out how to use the key. It can be made secure, but not if it's being used by an average user. Linux is more secure by default and the users tend to know what they're doing more.

Cleansing home PCs, I've seen some of the more exotic exploits become commonplace, including:

Direct Revenue hiding its core.DLL as a print monitor;one lone.DLL, registered in a CLSID key, warning of SPYWARE!!! from the system tray;launching executables from Group Policy subkeys;populating subkeys of Winolgon\Notify with self-renaming.DLL's.

Hiding malware so it launches before Explorer (and even before the antivirus app) is sneaky, underhanded, and ensures a steady stream of income so I don't need to get an actual job. Editing the Registry hives from WinPE is the only cost-effective way to remove many of these things, and Suzy Homeuser wull never be ready for that.So here's to you, scumbag malware writers... and here's to Microsoft for leaving soooo many ways to launch your malware: Thanks for paying my mortgage. Without security holes, and the slimeballs who exploit them, I'd be back selling auto parts.

That one that warns of "your pc is infected with malware" from system tray, known some places as smitfraud others as VX2, now uses several hundred reinfection methods, from infected active script desktop images, to the old favourite, making itself the default program to open files of type.exe

In fact, all those tricks you list are used by one version or the other (or if you are unlucky and get the latest updated version, all of them).

Faster now just to backup data, format and re-install than try and debug each and every method used by the particular version you have, I have tried auto remove tools, all of them end up out of date less than 24hrs after launch (someone is making enough from this thing that paying lots of money to a few programmers is not a problem).

The pay-off is of course when the user clicks that task bar balloon and it installs the "protection racket" software of choice onto your PC, which says it found 4366724 virus' and spyware, and to please pay them for a full licence to remove them. Of course if you pay them, it does NOT remove even its own malware, at least yesteryears organised crime DIDN'T break stuff if you paid.

The real kicker is, the 3-4 times I have seen it infect a pc (had user, on a fresh pc, do what they did when it first happened) it was through an IE "unpatched code execution" bug of the week.

When I tell people to use firefox, and then pre-install it on their new PC/repair, do they think it is a joke?

-->do they think-- there's your problem right there. I don't mean that to be as harsh as it sounds, they problem isn't that they are stupid, it's that they don't care. Something like 99.9% of people just want a 'internet' thingy, they don't care about having a computer or security or whatever, and if the blue e was the internet before, then it is probably still the internet now, and they don't care about the fire in your pants or whatever the hell you were rambling about when they were paying your bill.O

Something like 99.9% of people just want a 'internet' thingy, they don't care about having a computer or security or whatever, and if the blue e was the internet before, then it is probably still the internet now, and they don't care about the fire in your pants or whatever the hell you were rambling about when they were paying your bill.

Seriously, the only reason most people know they're running Windows is because it says so when they turn on the pc. There's the monitor, there's the "CPU," the mouse,

When I was the alpha geek on a four-geek Help Desk, we had to ask each caller for the computer name (we later used bginfo for that). We would ring a bell every time we got the answer "Dell," then patiently explain that the computer is a Dell, but the computer has a name on the network, and we need to figure out what that is...one woman interrupted me: "Trinitron?"

I see a lot of machines with multiple infestations, but I rarely rebuild 'em.My usual algorighm:

Start up in Safe ModeUse AutoRuns.exe to identify most of the offenders; delete those that don't self-reinstallOpen IE and then System Information; look at Loaded Modules to find the vx2.DLLs (hint: sort the list by Manufacturer)Boot to Windows PE; back up and load the Software and System hives & clean them up; do the same with the user hive(s)Boot into Windows and check for stragglers.

Whoever created the DarkFloppy.A worm appears not to have heard of e-mail, instant messaging or P2P systems, as the propagation methods they've chosen to spread this malicious code is... floppy disks. Not much chance of a massive epidemic then, is there?

Oh, well, I think they underestimate just how stupid some people are. I wonder who the unlucky person was who first nabbed that one.
Just goes to show, the internet is the "wild frontier" and that probably won't ever change.

Ten years ago, I pioneered a foolproof way to clean floppy disks.I worked at a chain of auto parts stores, with only five Windows machines. The marketing guy was constantly catching the Zombie virus from his drawer full of floppies.After about the 5th or 6th time, I took all the floppy disks out of his desk and smashed them with a ballpeen hammer.

I think that initiatives like these only make the problem much worse and that the people writing them are mere idiots who don't bother to think about the possible consequences. Yes, some people may consider this informative as a way of being kept up to date as to what has happened in the past year. The people who created and spread all this garbage may very well look upon this with a whole different attitude: "Look at that, see, I R teh l33t coder! My h4xkZ r made teh top!" resulting in some other lame clue

Well, the GP said the spyware "monitors whether users access certain web pages with pornographic content". Sexual matters being involved, the expression "voyeuristic tendencies" is appropriate. If I want to know what kind of motor my neighbor has in her car, I'm being "curious", if I want to know what kind of panties she's wearing, then I'm a "voyeur".

The time is ripe for a beneficial virus, one that does no harm to the host computer, but acts as a keylogger that will play a very loud annoying buzing noise and kill all open apps if the user types: "misa campo", "made of win", "internets", "begs the question", or any other word or phrase from a list of current phrases used by morons.

The general public generally only hears about the viruses that spread quickly and do damage...but the range of exploits is just amazing. One of my favorites is summarized this way, in the article:

"- The biggest snooper. In this case, it was not a difficult choice. WebMic.A is a malicious code that can record sounds and images, using a microphone and WebCam connected to the computer. Of course this is not the sort of uninvited guest you would like to have on your PC."

Yeah, those 4 items are good, but "Joe" is STILL skating on thin ice unless he adds a 5th item - a clue.

The other user who, I've noticed, rapidly messes up a computer even with the above 4 things installed is "average teen with half a clue" who is somewhat aware they should not install bad things, but assumes that if it is something that all their friends install, or something they feel they just gotta install, then it can't hurt them.